A Critical Look at Decentralized Personal Data Architectures

While the Internet was conceived as a decentralized network, the most widely used web applications today tend toward centralization. Control increasingly rests with centralized service providers who, as a consequence, have also amassed unprecedented amounts of data about the behaviors and personalities of individuals. Developers, regulators, and consumer advocates have looked to alternative decentralized architectures as the natural response to threats posed by these centralized services. The result has been a great variety of solutions that include personal data stores (PDS), infomediaries, Vendor Relationship Management (VRM) systems, and federated and distributed social networks. And yet, for all these efforts, decentralized personal data architectures have seen little adoption. This position paper attempts to account for these failures, challenging the accepted wisdom in the web community on the feasibility and desirability of these approaches. We start with a historical discussion of the development of various categories of decentralized personal data architectures. Then we survey the main ideas to illustrate the common themes among these efforts. We tease apart the design characteristics of these systems from the social values that they (are intended to) promote. We use this understanding to point out numerous drawbacks of the decentralization paradigm, some inherent and others incidental. We end with recommendations for designers of these systems for working towards goals that are achievable, but perhaps more limited in scope and ambition. 1. BRIEF HISTORICAL OVERVIEW The search for alternatives to centralized aggregation of personal data began in the late 1990s which saw a wave of so-called ‘negotiated privacy techniques’ including commercial ‘infomediaries’ [24, 16]. These entities would store consumers’ data and help facilitate the drafting of contracts that set the terms of the exchange and use of data. The 1999 book Net Worth [23] galvanized both industry and privacy advocates, generating hopes for a future in which privacy problems could be solved through a mix of decentralized storage and private contracts, potentially obviating the need for privacy law or even the adoption of fair information practices [10, 60]. Within five years, nearly all of this excitement had faded and all commercial (Persona, Privada, Lumeria, etc.) and community (P3P) initiatives had floundered [1] — some in truly spectacular fashion, such as AllAdvantage. And yet, by the end of the decade, many new initiatives and projects that shared almost identical goals emerged. Vendor Relationship Management (VRM) [35] has gained steady momentum as a general set of principles that aim simultaneously to improve user privacy, enhance customer autonomy, and increase market efficiency through a combination of mechanisms that aggregate data in a single (per-user) repository under users’ control and tools to negotiate agreements that would grant outside organizations access to and use of that data. Parallel efforts to develop so-called personal data stores (PDS), personal data servers, personal data lockers/vaults, and personal clouds [18] have focused more narrowly on the platforms and protocols to support unified repositories of user data that could be managed locally by the user or outsourced to a trusted third party. The impetus for these projects are varied, ranging from user interest in aggregating one’s own data in a single location to better derive benefits from their mixing and matching to more explicit interests in privacy (user control) and commerce (a market place for sharing, including possibilities for cash payments in exchange for data) [13]. The similarities between these and earlier efforts can be quite stark: Mydex’s recent white paper, “The Case for Personal Information Empowerment” [38], recapitulates much that was described in a white paper released a full decade earlier by Lumeria, a failed infomediary [30]. To describe this as a simple case of “an idea whose time has come” would be to miss the important lessons that these earlier and recurring failures should offer those who wish to pursue decentralized personal data architectures. Decentralized social networking has been a largely parallel, sometimes overlapping line of development with similar motivations. We subdivide such social networks into federated (ecosystem of interoperable implementations in the clientserver model) and distributed (peer-to-peer). The term distributed social networking is frequently but incorrectly used to describe all decentralized social networks. While some early thinking in the semantic web community could be classified in this category, for the most part decentralized social networking appears not to have anticipated the success of mainstream commercial, centralized social networks, but rather developed as a response to it. Indeed, prominent members of the web community dismissed social networks until 2007–2008 (for example, [27] and [15]) and academic computer scientists appear to have considered it a passing fad as well — in our survey we see a sharp spike in interest among researchers around this time frame. A series of well-publicized privacy mishaps by Facebook and Google starting in 2009 that reached its crescendo around the 2010 f8 developer conference stirred up interest among the public and policymakers. Perhaps the most well known project that resulted is Diaspora, which was funded in excess of $200,000 via the crowd funding platform kickstarter.com. As of this writing Wikipedia lists about 40 decentralized social networks [58], most of which are federated, whereas the academic literature has focused on distributed social networking for natural reasons, since those present more research challenges. 2. REPRESENTATIVE SURVEY Rather than attempt an exhaustive survey, in this section we list the key ideas that have been explored in the course of developing decentralized designs. There has been a great fecundity of creative and complex ideas in this space spanning the realms of technology, law and economics; we are unable to present them in detail due to space constraints. We refer the reader to the cited works. The core idea of an infomediary is that of a trusted third party that interfaces between the user and commercial entities such as marketers [23]. Users’ personal data can be manually given to the infomediary, as in Lumeria, or collected through passive monitoring, as in AllAdvantage and other systems [20]. That information can then be utilized without explicit monetization (Mydex, etc.), or users can be paid for their data (AllAdvantage, Bynamite [29], etc). It has variously been argued that telecommunications providers [55, 4], banks [9] and other parties such as providers of home entertainment set-top boxes are ideally suited to play the role of the intermediary. An infomediary might also enable a targeted attention market [39] based on user preferences. Kang et al. introduce the intriguing idea of licensing intermediaries to increase their trustworthiness [28]. In the other direction, Vendor Relationship Management systems largely eliminate the infomediary as a separate entity, and instead replace it with a software agent [35]. Some software intermediaries like Adnostic use cryptography to achieve additional privacy properties [54]. Other ideas for improving privacy include fine-grained access control lists [37]. Both VRM and infomediary systems often emphasize benefits to the firm from the intermediated nature of the exThe Internet Archive lists a version of the Friend of a Friend (FOAF) project (www.foaf-project.org) from August 2003, and other efforts may be older. For an article typifying public opinion during that period, see [45]. https://joindiaspora.com/ change. Goldman [21] envisions that software agents will make marketing messages perfectly relevant, eliminating externalities from wasted attention. By Coase’s theorem [34], this will lead to a socially optimal level of marketing. Turning to social networks, the key challenge of distributed social networks is hosting and message transfer. One solution is to encrypt messages and store them in a distributed hash table [8, 2]. Another is “social replication”: messages are stored in plaintext in a redundant manner by those who have access rights (typically friends of the message poster) [49]. Message passing sometimes exploits the relationship between the social graph and the topology of the physical network [25, 8]. Another frequent goal is keeping edges of the graph secret, for which various solutions have been proposed: a cryptographic approach [5], anonymous routing [14] and friendto-friend networks such as Freenet in ‘darknet’ mode [12]. Persona takes the cryptographic heavy-lifting a step further to enable fine-grained access control using attribute-based encryption [6]. Other models for hosting have been explored. In vis-a-vis, each user owns an EC2 virtual host that is active at all times [48], whereas FreedomBox proposes cheap plug computers. Lam et al. have proposed email as a backend [19] and ephemeral networks on smartphones [17]. Unhosted proposes separating data from code, but keeping both in the cloud. Along similar lines, Frenzy is a distributed social network software with Dropbox as the backend. Polaris proposes reducing existing social networks such as Youtube and Twitter to datastores and layering a social network on top, with smartphones providing access control management interfaces [59]. Finally, federated social networks aim to create an ecosystem of standards-based interoperable implementations of social networks. Some designs such as Diaspora are a hybrid between distributed and federated. OStatus, being coordinated by the W3C, represents an interesting approach to standardization for federated microblogging: it references a suite of existing protocols rather than developing them from scratch.